Splunk Search

How to Merge count two different field values

Manasi25
Explorer

I have different Fields values like - teamNameTOC, teamNameEngine  under same field Name(teamName) want to merge these two values in single report.

I have tried below and output also attached

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName

OUTPUT 

teamName count percent
TOC 233 50.000000
Engine 84 18.025751
DA 66 14.163090
SE 55 11.802575
DBA 28


I need all above values Count (team name , count , %) in one row as single entity. % should adjust itself if add new more values.

Output should look like - 

teamName count percent

All Teams 466 100.00

 

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You should be able to do that with the append command.

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| append [teamName=A OR teamName=B OR teamName=C OR teamName=D | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IB" ]
| table teamName, count, percent

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It's not clear what the final result should be.  If you want a total row in addition to the existing results then try this search:

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| addcoltotals labelfield=teamName label="All Teams"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Manasi25
Explorer

HI. Thank you for reply.

Solution you given resulted same as mine mentioned commands.

I need "All Teams"'s count  ONLY the output and want to rename "All teams" as a "IA".

Manasi25_0-1596686813600.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| table teamName, count, percent
---
If this reply helps you, Karma would be appreciated.
0 Karma

Manasi25
Explorer

Thank you so much ! Its worked good.

Kindly let me know, how can I add one more row of another fields to get result as below- 

I have field values for "IB" and need to add row below the result  of"IA".

Fileds Values -

teamName=A OR teamName=B OR teamName=C OR teamName=D OR teamName=E | top limit=50 teamName   

 

RoutingKey    Count   Percentage

IA                         250        100.00

IB                         count             %

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should be able to do that with the append command.

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| append [teamName=A OR teamName=B OR teamName=C OR teamName=D | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IB" ]
| table teamName, count, percent

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

Manasi25
Explorer

Thank you so much ! It worked.

0 Karma

Manasi25
Explorer

Hi Rich

 

Solution you given worked perfectly, but its parsing my output and getting time for result.

Also, I need average of all results , but it do sum of all avg in Totals. Plz advise.

Manasi25_1-1599377950303.png

 

 

Manasi25_0-1599377885430.png

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...